The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests data from external sources that are not under the user's direct control, which could potentially contain malicious instructions.
Ingestion points: The outbound agent visits lead websites; the sales prep agent visits client websites; the support agent reads incoming client emails; and the sales live agent reads call transcript files.
Boundary markers: The instructions lack explicit delimiters or specific warnings for the agent to ignore instructions that might be embedded within the content of external websites or emails.
Capability inventory: The skill has the capability to write local files, browse the web, access email APIs, and execute shell commands via the agent's tools.
Sanitization: While the skill correctly directs the agent to leave placeholders for credentials in generated code, it does not provide explicit mechanisms to sanitize or filter text content gathered from external sources before it is processed by the AI.
[DYNAMIC_EXECUTION]: The skill is designed to generate and execute code at runtime as a core feature.
Evidence: The build agent instructions command the agent to "Build the automation... working code... and a test" and then explicitly to "Run the test."
[COMMAND_EXECUTION]: The skill utilizes shell commands based on file paths provided by the user to monitor live transcripts.
Evidence: The sales live agent is instructed to execute tail -n 40 <file> and sleep 10 in a loop using a path supplied by the user. If the file path input is not validated, it could be misused for command injection or unauthorized access to other files on the system.

agency